GO-2026-6497 vulnerabilities

Vulnerabilities for packages: k9s, rancher-helm, cluster-api-helm-controller, helm-push, manifest-tool, k8sgpt, helm-set-status, flux-helm-controller, cert-manager-cmctl, kargo, kube-arangodb, gitness, kyverno-notation-aws, maru, xeol, helm-mapkubeapis, opentofu...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: k9s, rancher-helm, cluster-api-helm-controller, helm-push, manifest-tool, k8sgpt, helm-set-status, flux-helm-controller, cert-manager-cmctl, kargo, kube-arangodb, gitness, kyverno-notation-aws, maru, xeol, helm-mapkubeapis, opentofu...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: spegel, kubescape-operator, newrelic-infrastructure-agent, fuse-overlayfs-snapshotter, docker, zarf, kube-arangodb, dagger, rancher, k3s, docker-cli-buildx, helm-mapkubeapis, skaffold, kubevela, k9s, wolfictl, eksctl, buildkitd, helm-set-status, kargo, headlamp,...

PT-2026-94502

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where the ksmbd all conn set status function incorrectly treats every connection with a set transient binding flag as belonging to the target SessionI...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: drone-fips, kots, steampipe, linkerd2, argo-cd, rancher, kubescape-server, chartmuseum-fips, kyverno-notation-aws, headlamp-fips, chaos-mesh-fips, rancher-agent, helm-exporter-fips, consul-k8s, zarf, ocm-cli-fips, trivy-operator-fips, cloudbeat, kgateway-fips,...

GO-2026-5338 vulnerabilities

Vulnerabilities for packages: spegel, helm, kubescape-operator, newrelic-infrastructure-agent, fuse-overlayfs-snapshotter, containerd, docker, linkerd2, zarf, kube-arangodb, dagger, rancher, docker-cli-buildx, helm-mapkubeapis, k3s, skaffold, kubevela, k9s, consul-k8s, teleport, wolfictl, eksctl,...

GO-2026-5475 vulnerabilities

Vulnerabilities for packages: spegel, helm, kubescape-operator, newrelic-infrastructure-agent, fuse-overlayfs-snapshotter, docker, linkerd2, zarf, kube-arangodb, dagger, rancher, docker-cli-buildx, helm-mapkubeapis, k3s, skaffold, kubevela, k9s, consul-k8s, teleport, wolfictl, eksctl, buildkitd,...

GO-2025-4108 vulnerabilities

Vulnerabilities for packages: spegel, helm, kubescape-operator, newrelic-infrastructure-agent, fuse-overlayfs-snapshotter, containerd, zarf, flux-source-controller, dagger, docker-cli-buildx, helm-mapkubeapis, k3s, skaffold, kubevela, k9s, rancher-fleet, wolfictl, eksctl, buildkitd,...

GO-2025-3888 vulnerabilities

Vulnerabilities for packages: cerbos, linkerd2, zarf, flux-source-controller, helm-mapkubeapis, k9s, rancher-fleet, eksctl, helm-set-status, cert-manager-cmctl, kargo, headlamp, kubescape, chart-testing, cilium-cli, trivy, pluto, cluster-api-helm-controller, zot, k8sgpt, flux-helm-controller,...

GO-2026-5879 vulnerabilities

Vulnerabilities for packages: oras, helm, falcoctl, linkerd2, zarf, kube-arangodb, rancher, helm-mapkubeapis, ratify, k9s, rancher-fleet, consul-k8s, teleport, eksctl, helm-set-status, cert-manager-cmctl, kargo, headlamp, kubescape, maru, cilium-cli, kyverno, trivy, rancher-helm, tw,...

GO-2026-5884 vulnerabilities

Vulnerabilities for packages: oras, helm, falcoctl, linkerd2, zarf, kube-arangodb, rancher, helm-mapkubeapis, ratify, k9s, rancher-fleet, consul-k8s, teleport, eksctl, helm-set-status, cert-manager-cmctl, kargo, headlamp, kubescape, maru, cilium-cli, kyverno, trivy, rancher-helm, tw,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: helm, flux-kustomize-controller, cosign, fuse-overlayfs-snapshotter, kubeflow-katib, redka, aws-flb-cloudwatch, src, flux-notification-controller, newrelic-fluent-bit-output, spire-server, k3s, kubernetes-dashboard-api, minio, bento, ingress-nginx-controller, eksctl,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: harbor-registry, falcoctl, mongo-tools, nuclei, kapp, harbor-cli, spire-controller-manager, nri-f5, docker-cli-buildx, neuvector-sigstore-interface, kubernetes-dashboard-api, spark-operator, helm-set-status, buildkitd, cluster-api-provider-vsphere,...

GHSA-PR2V-JX2C-WG9F Tornado vulnerable to Header Injection and XSS via reason argument

Header injection and XSS via reason argument Summary The reason argument used by both RequestHandler.setstatus and tornado.web.HTTPError is designed to allow applications to pass custom "reason" phrases the "Not Found" in HTTP/1.1 404 Not Found to the HTTP status line mainly for non-standard stat...

MantisBT: REST API unauthorized Issue status change

A MantisBT user having $gupdatebugthreshold UPDATER by default can change an Issue's Status via REST and SOAP API, even if the $gsetstatusthreshold config is set to a higher level DEVELOPER by default. Impact Unauthorized change in Issue workflow. Patches...

PT-2026-60358

A MantisBT user having $g update bug threshold UPDATER by default can change an Issue's Status via REST and SOAP API, even if the $g set status threshold config is set to a higher level DEVELOPER by default. Impact Unauthorized change in Issue workflow. Patches...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013346)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013346 advisory. In the Linux kernel, the following vulnerability has been resolved: loop: loopsetstatusfrominfo check before assignment In loopsetstatusfrominfo, lo-looffset and...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010936)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010936 advisory. In the Linux kernel, the following vulnerability has been resolved: loop: loopsetstatusfrominfo check before assignment In loopsetstatusfrominfo, lo-looffset and...

Improper Authorization

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Improper Authorization in the overrideStatus request parameter, which is processed by the setStatus function. An attacker can bypass administrative moderation and...

HTTP Header Injection

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to HTTP Header Injection via the reason argument in HTTP status handling. An attacker can inject arbitrary HTTP headers or execute...